tls-error while connecting

this can be reproduced when building riseup-vpn on buster (edit: actually, when running on buster).

the systray log simply states "RECONNECTING: tls-error".

launching openvpn manually with increased verbosity gives the following:

Thu Jan 24 15:47:48 2019 us=484243 Deprecated TLS cipher name 'DHE-RSA-AES128-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-128-CBC-SHA'
Thu Jan 24 15:47:48 2019 us=485924 Control Channel MTU parms [ L:1623 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Thu Jan 24 15:47:48 2019 us=486034 Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
Thu Jan 24 15:47:48 2019 us=486146 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Jan 24 15:47:48 2019 us=486257 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Jan 24 15:47:48 2019 us=486330 TCP/UDP: Preserving recently used remote address: [AF_INET]37.218.242.216:443
Thu Jan 24 15:47:48 2019 us=486490 Socket Buffers: R=[87380->87380] S=[16384->16384]
Thu Jan 24 15:47:48 2019 us=486557 Attempting to establish TCP connection with [AF_INET]37.218.242.216:443 [nonblock]
Thu Jan 24 15:47:49 2019 us=487488 TCP connection established with [AF_INET]37.218.242.216:443
Thu Jan 24 15:47:49 2019 us=487699 TCP_CLIENT link local: (not bound)
Thu Jan 24 15:47:49 2019 us=487819 TCP_CLIENT link remote: [AF_INET]37.218.242.216:443
Thu Jan 24 15:47:49 2019 us=551553 TLS: Initial packet from [AF_INET]37.218.242.216:443, sid=3db5cf4e ec0c0700
Thu Jan 24 15:47:49 2019 us=747790 OpenSSL: error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol
Thu Jan 24 15:47:49 2019 us=748038 TLS_ERROR: BIO read tls_read_plaintext error
Thu Jan 24 15:47:49 2019 us=748240 TLS Error: TLS object -> incoming plaintext read error
Thu Jan 24 15:47:49 2019 us=748362 TLS Error: TLS handshake failed
Thu Jan 24 15:47:49 2019 us=748573 Fatal TLS error (check_tls_errors_co), restarting
Thu Jan 24 15:47:49 2019 us=748771 TCP/UDP: Closing socket
Thu Jan 24 15:47:49 2019 us=748974 SIGUSR1[soft,tls-error] received, process restarting
Thu Jan 24 15:47:49 2019 us=749273 Restart pause, 5 second(s)